Module 3 · Unit 6 · 10 Lessons
COMP 6660 · Enterprise Cybersecurity Enterprise Cybersecurity Governance, Risk, and Compliance
Examines how enterprises direct, assure, and sustain their security programmes: governance and policy, risk and compliance, awareness and auditing, incident response, continuity and recovery, resilience, and the emerging issues reshaping the field.
01 Unit overview
Modules 1 and 2 built the technical and analytical apparatus. Unit 6 asks the question that determines whether any of it survives contact with a real enterprise: who owns security, how is it governed, how is it assured, and how does the organisation recover when prevention fails?
The unit opens with cybersecurity governance: board and executive accountability, security strategy, operating models, and the three-lines-of-defence structure that separates management, oversight, and independent assurance. This leads directly into the policy hierarchy — policy, standard, procedure, guideline — and the practical problem of writing controls that are enforceable rather than aspirational.
Risk management is treated as a governance activity, not a technical one. Students work with recognised frameworks such as the NIST Risk Management Framework and ISO/IEC 27005, examine risk treatment options, and practise communicating risk to decision-makers in language that supports prioritisation and investment. Compliance and regulatory requirements follow, including privacy and sectoral obligations and breach-notification regimes — with explicit attention to the difference between being compliant and being secure.
The middle of the unit turns to people and assurance. Security awareness and human factors examines why awareness programmes fail, how behavioural drivers shape risk, and how to design and measure programmes that reduce reliance on user vigilance. Cybersecurity auditing introduces audit scope and evidence, control testing, assurance reporting, and the discipline of responding to findings without defensiveness.
The final third addresses failure and recovery. Incident response planning covers the full lifecycle — preparation, detection and analysis, containment, eradication, recovery, and post-incident review. Business continuity and disaster recovery introduces business impact analysis, RTO and RPO, recovery strategies, and exercising the plan. Cyber resilience and enterprise recovery extends this to designing for degradation, crisis leadership, and organisational learning from major incidents.
The unit closes with emerging trends and future directions: artificial intelligence in enterprise cybersecurity, digital sovereignty, quantum risk, and the evolving regulatory landscape. Throughout, students are expected to connect governance decisions back to the technical architectures studied in Module 2 and to frame recommendations in terms of risk, cost, and organisational capability.
| Unit | 6 — Enterprise Cybersecurity Governance, Risk, and Compliance |
|---|---|
| Module | Module 3 — Governance, Operations, and Enterprise Resilience |
| Lessons | 10 (Lessons 6.1–6.10) |
| Discussion forum | Forum 6 — Cybersecurity Governance and Resilience |
| Assessed by | Assignment 3 (20%) and Part C of the final examination |
| Recommended weeks | Weeks 12–13 (review in week 14) |
| Primary CLOs | CLO1, CLO6, CLO7, CLO8, CLO9 |
02 Unit learning outcomes
Upon completion of Unit 6, students will be able to:
Governance & risk
- Develop governance frameworks.
- Conduct compliance assessments.
- Evaluate security awareness and human-factor programmes.
- Plan and support cybersecurity auditing activities.
Operations & resilience
- Design incident-response processes.
- Develop cyber-resilience strategies.
- Design business continuity and disaster recovery arrangements.
Emerging issues & scholarship
- Assess emerging cybersecurity technologies, trends, and challenges.
- Evaluate the opportunities and risks of artificial intelligence in enterprise cybersecurity.
- Communicate governance and resilience findings in scholarly form.
Full statement
The authoritative unit learning outcomes, including their mapping to the nine course learning outcomes, are published on the Unit 6 learning outcomes page.
| CLO | Statement | Coverage in Unit 6 |
|---|---|---|
| CLO1 | Define the scope, objectives, principles, and strategic importance of enterprise cybersecurity. | Reinforced at strategic level |
| CLO6 | Develop cybersecurity governance, risk-management, compliance, and policy frameworks. | Developed and assessed (Lessons 6.1–6.6) |
| CLO7 | Evaluate incident response, business continuity, disaster recovery, and cyber-resilience strategies. | Developed and assessed (Lessons 6.7–6.9) |
| CLO8 | Assess emerging cybersecurity technologies, trends, and challenges. | Developed and assessed (Lesson 6.10) |
| CLO9 | Conduct scholarly research and communicate findings effectively. | Practised (Assignment 3, Forum 6, final exam) |
03 Lessons in this unit
Unit 6 contains ten lessons. Lessons 6.1–6.4 cover governance, policy, risk, and compliance; Lessons 6.5–6.6 address people and assurance; Lessons 6.7–6.10 cover incident response, continuity, resilience, and emerging trends.
Cybersecurity Governance
Board and executive accountability, security strategy, operating models, and the three lines of defence.
Topics: board accountability · security strategy · operating models · three lines of defence
Lesson 6.2Security Policies and Standards
The policy hierarchy — policy, standard, procedure, guideline — and how to make it enforceable.
Topics: policy hierarchy · standards · procedures · enforceability
Lesson 6.3Risk Management Frameworks
NIST RMF, ISO 31000 and ISO/IEC 27005, risk treatment, and communicating risk to decision-makers.
Topics: NIST RMF · ISO 31000 · ISO/IEC 27005 · risk treatment · risk communication
Lesson 6.4Compliance and Regulatory Requirements
Privacy, sectoral, and breach-notification obligations, and the difference between compliance and security.
Topics: privacy regulation · sectoral requirements · breach notification · compliance vs security
Lesson 6.5Security Awareness and Human Factors
Behavioural drivers, awareness programme design, measurement, and reducing reliance on user vigilance.
Topics: behavioural drivers · awareness programme design · measurement · human factors
Lesson 6.6Cybersecurity Auditing
Audit scope and evidence, control testing, assurance reporting, and responding to findings.
Topics: audit scope · evidence · control testing · assurance reporting
Lesson 6.7Incident Response Planning
Preparation, detection and analysis, containment, eradication, recovery, and post-incident review.
Topics: IR lifecycle · preparation · containment · eradication · post-incident review
Lesson 6.8Business Continuity and Disaster Recovery
Business impact analysis, RTO and RPO, recovery strategies, and exercising the plan.
Topics: business impact analysis · RTO · RPO · recovery strategies · exercising
Lesson 6.9Cyber Resilience and Enterprise Recovery
Designing for degradation and recovery, crisis leadership, and learning from major incidents.
Topics: resilience by design · crisis leadership · recovery · organisational learning
Lesson 6.10Emerging Trends and Future Directions
AI in cybersecurity, digital sovereignty, quantum risk, and the evolving regulatory landscape.
Topics: AI in cybersecurity · digital sovereignty · quantum risk · regulation
04 Discussion and assessment
Forum 6 — Cybersecurity Governance and Resilience
Unit 6 hosts the sixth and final graded discussion forum. Contribute an initial posting of approximately 300–500 words supported by scholarly sources, plus at least two meaningful responses to classmates.
Example discussion topics:
- NIST CSF versus ISO 27001.
- Incident response practices.
- AI and cybersecurity governance.
How Unit 6 is assessed
Unit 6 is assessed through Assignment 3 — Enterprise Security Governance and Cyber Resilience (20% of the final grade), which covers Unit 6 and integrated course concepts.
Research topic: Cybersecurity Governance and Risk Management in Large Enterprises: Integrating NIST CSF, ISO/IEC 27001, and Zero Trust Principles.
Technical questions include:
- Develop a cybersecurity governance framework for a university.
- Perform a cybersecurity risk assessment for critical infrastructure.
- Develop an enterprise ransomware incident-response plan.
- Design a business continuity and disaster recovery strategy.
- Evaluate the opportunities and risks of artificial intelligence in enterprise cybersecurity.
Final examination
The final examination (30%) covers all units and learning outcomes. Part C (40% of the exam) presents an enterprise case study requiring risk assessment, architectural analysis, governance considerations, and strategic recommendations — drawing directly on the governance and resilience material in this unit. Examination brief →
Reading order
Lessons 6.1–6.4 establish the governance, risk, and compliance vocabulary used throughout the unit. Complete them before moving to people, assurance, and resilience — particularly if you are working on Assignment 3 or preparing for Part C of the final examination.